fix(state-repo): pass auth token through stateInit and sync correctly with remote

- Pass GitHub token from ensureStateDotDockerGitRepo through stateInit to all
  git operations (clone, fetch, adopt-remote), fixing auth failures on private repos
- Replace git reset --soft with stash → hard reset → stash pop in sync flow so
  remote is always pulled first and local changes overlay on top without deleting
  remote files
- Resolve stash pop conflicts by keeping local version (--theirs)
- Add env parameter to adoptRemoteHistoryIfOrphan, cloneStateRepo,
  initRepoIfNeeded, ensureOriginRemote, checkoutBranchBestEffort

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: skulidropek

packages/lib/src/usecases/state-repo-github.ts

@@ -123,7 +123,7 @@ export const ensureStateDotDockerGitRepo = (
       }
 
       yield* _(Effect.log(`Initializing state repository: ${cloneUrl}`))
-      yield* _(stateInit({ repoUrl: cloneUrl, repoRef: defaultStateRef }))
+      yield* _(stateInit({ repoUrl: cloneUrl, repoRef: defaultStateRef, token }))
     })
   ).pipe(
     Effect.matchEffect({

packages/lib/src/usecases/state-repo.ts

@@ -17,6 +17,7 @@ import {
   isGitRepo,
   successExitCode
 } from "./state-repo/git-commands.js"
+import type { GitAuthEnv } from "./state-repo/github-auth.js"
 import { isGithubHttpsRemote, resolveGithubToken, withGithubAskpassEnv } from "./state-repo/github-auth.js"
 import { ensureStateGitignore } from "./state-repo/gitignore.js"
 import { runStateSyncOps, runStateSyncWithToken } from "./state-repo/sync-ops.js"
@@ -132,16 +133,18 @@ export const autoSyncState = (message: string): Effect.Effect<void, never, State
 type StateInitInput = {
   readonly repoUrl: string
   readonly repoRef: string
+  readonly token?: string
 }
 
 const cloneStateRepo = (
   root: string,
-  input: StateInitInput
+  input: StateInitInput,
+  env: GitAuthEnv
 ): Effect.Effect<void, CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
   Effect.gen(function*(_) {
     const cloneWithBranch = ["clone", "--branch", input.repoRef, input.repoUrl, root]
     const cloneBranchExit = yield* _(
-      runCommandExitCode({ cwd: root, command: "git", args: cloneWithBranch, env: gitBaseEnv })
+      runCommandExitCode({ cwd: root, command: "git", args: cloneWithBranch, env })
     )
     if (cloneBranchExit === successExitCode) {
       return
@@ -156,7 +159,7 @@ const cloneStateRepo = (
     )
     const cloneDefault = ["clone", input.repoUrl, root]
     const cloneDefaultExit = yield* _(
-      runCommandExitCode({ cwd: root, command: "git", args: cloneDefault, env: gitBaseEnv })
+      runCommandExitCode({ cwd: root, command: "git", args: cloneDefault, env })
     )
     if (cloneDefaultExit !== successExitCode) {
       return yield* _(Effect.fail(new CommandFailedError({ command: "git clone", exitCode: cloneDefaultExit })))
@@ -167,7 +170,8 @@ const initRepoIfNeeded = (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   root: string,
-  input: StateInitInput
+  input: StateInitInput,
+  env: GitAuthEnv
 ): Effect.Effect<void, CommandFailedError | PlatformError, StateRepoEnv> =>
   Effect.gen(function*(_) {
     yield* _(fs.makeDirectory(root, { recursive: true }))
@@ -180,32 +184,34 @@ const initRepoIfNeeded = (
 
     const entries = yield* _(fs.readDirectory(root))
     if (entries.length === 0) {
-      yield* _(cloneStateRepo(root, input))
+      yield* _(cloneStateRepo(root, input, env))
       yield* _(Effect.log(`State dir cloned: ${root}`))
       return
     }
 
-    yield* _(git(root, ["init", "--initial-branch=main"], gitBaseEnv))
+    yield* _(git(root, ["init", "--initial-branch=main"], env))
   }).pipe(Effect.asVoid)
 
 const ensureOriginRemote = (
   root: string,
-  repoUrl: string
+  repoUrl: string,
+  env: GitAuthEnv
 ): Effect.Effect<void, CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
   Effect.gen(function*(_) {
-    const setUrlExit = yield* _(gitExitCode(root, ["remote", "set-url", "origin", repoUrl], gitBaseEnv))
+    const setUrlExit = yield* _(gitExitCode(root, ["remote", "set-url", "origin", repoUrl], env))
     if (setUrlExit === successExitCode) {
       return
     }
-    yield* _(git(root, ["remote", "add", "origin", repoUrl], gitBaseEnv))
+    yield* _(git(root, ["remote", "add", "origin", repoUrl], env))
   })
 
 const checkoutBranchBestEffort = (
   root: string,
-  repoRef: string
+  repoRef: string,
+  env: GitAuthEnv
 ): Effect.Effect<void, CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
   Effect.gen(function*(_) {
-    const checkoutExit = yield* _(gitExitCode(root, ["checkout", "-B", repoRef], gitBaseEnv))
+    const checkoutExit = yield* _(gitExitCode(root, ["checkout", "-B", repoRef], env))
     if (checkoutExit === successExitCode) {
       return
     }
@@ -214,21 +220,28 @@ const checkoutBranchBestEffort = (
 
 export const stateInit = (
   input: StateInitInput
-): Effect.Effect<void, CommandFailedError | PlatformError, StateRepoEnv> =>
-  Effect.gen(function*(_) {
-    const fs = yield* _(FileSystem.FileSystem)
-    const path = yield* _(Path.Path)
-    const root = resolveStateRoot(path, process.cwd())
-
-    yield* _(initRepoIfNeeded(fs, path, root, input))
-    yield* _(ensureOriginRemote(root, input.repoUrl))
-    yield* _(adoptRemoteHistoryIfOrphan(root, input.repoRef))
-    yield* _(checkoutBranchBestEffort(root, input.repoRef))
-    yield* _(ensureStateGitignore(fs, path, root))
-
-    yield* _(Effect.log(`State dir ready: ${root}`))
-    yield* _(Effect.log(`Remote: ${input.repoUrl}`))
-  }).pipe(Effect.asVoid)
+): Effect.Effect<void, CommandFailedError | PlatformError, StateRepoEnv> => {
+  const doInit = (env: GitAuthEnv) =>
+    Effect.gen(function*(_) {
+      const fs = yield* _(FileSystem.FileSystem)
+      const path = yield* _(Path.Path)
+      const root = resolveStateRoot(path, process.cwd())
+
+      yield* _(initRepoIfNeeded(fs, path, root, input, env))
+      yield* _(ensureOriginRemote(root, input.repoUrl, env))
+      yield* _(adoptRemoteHistoryIfOrphan(root, input.repoRef, env))
+      yield* _(checkoutBranchBestEffort(root, input.repoRef, env))
+      yield* _(ensureStateGitignore(fs, path, root))
+
+      yield* _(Effect.log(`State dir ready: ${root}`))
+      yield* _(Effect.log(`Remote: ${input.repoUrl}`))
+    }).pipe(Effect.asVoid)
+
+  const token = input.token?.trim() ?? ""
+  return token.length > 0 && isGithubHttpsRemote(input.repoUrl)
+    ? withGithubAskpassEnv(token, doInit)
+    : doInit(gitBaseEnv)
+}
 
 export const stateStatus = Effect.gen(function*(_) {
   const path = yield* _(Path.Path)

packages/lib/src/usecases/state-repo/adopt-remote.ts

@@ -2,7 +2,8 @@ import type * as CommandExecutor from "@effect/platform/CommandExecutor"
 import type { PlatformError } from "@effect/platform/Error"
 import { Effect } from "effect"
 import type { CommandFailedError } from "../../shell/errors.js"
-import { git, gitBaseEnv, gitExitCode, successExitCode } from "./git-commands.js"
+import { git, gitExitCode, successExitCode } from "./git-commands.js"
+import type { GitAuthEnv } from "./github-auth.js"
 
 // CHANGE: align local history with remote when histories have no common ancestor
 // WHY: prevents creation of new branches when local repo was git-init'd without cloning (divergent root commits)
@@ -14,48 +15,52 @@ import { git, gitBaseEnv, gitExitCode, successExitCode } from "./git-commands.js
 // COMPLEXITY: O(1) git operations
 export const adoptRemoteHistoryIfOrphan = (
   root: string,
-  repoRef: string
+  repoRef: string,
+  env: GitAuthEnv
 ): Effect.Effect<void, CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
   Effect.gen(function*(_) {
     // Fetch remote history first — required for merge-base and reset
-    const fetchExit = yield* _(gitExitCode(root, ["fetch", "origin", repoRef], gitBaseEnv))
+    const fetchExit = yield* _(gitExitCode(root, ["fetch", "origin", repoRef], env))
     if (fetchExit !== successExitCode) {
       yield* _(Effect.logWarning(`git fetch origin ${repoRef} failed (exit ${fetchExit}); starting fresh history`))
       return
     }
     const remoteRef = `origin/${repoRef}`
     const hasRemoteExit = yield* _(
-      gitExitCode(root, ["show-ref", "--verify", "--quiet", `refs/remotes/${remoteRef}`], gitBaseEnv)
+      gitExitCode(root, ["show-ref", "--verify", "--quiet", `refs/remotes/${remoteRef}`], env)
     )
     if (hasRemoteExit !== successExitCode) {
       return // Remote branch does not exist yet (brand-new repo)
     }
 
     // Case 1: orphan branch (no local commits at all)
-    const revParseExit = yield* _(gitExitCode(root, ["rev-parse", "HEAD"], gitBaseEnv))
+    const revParseExit = yield* _(gitExitCode(root, ["rev-parse", "HEAD"], env))
     if (revParseExit !== successExitCode) {
-      yield* _(git(root, ["reset", "--soft", remoteRef], gitBaseEnv))
+      // Mixed reset: moves HEAD and updates index to match remote (working tree untouched)
+      yield* _(git(root, ["reset", remoteRef], env))
+      // Populate working tree with remote files, skipping files that already exist locally
+      yield* _(gitExitCode(root, ["checkout-index", "--all"], env))
       yield* _(Effect.log(`Adopted remote history from ${remoteRef}`))
       return
     }
 
     // Case 2: local commits exist but histories share no common ancestor
     // (e.g. git-init without cloning produced a divergent root commit)
-    const mergeBaseExit = yield* _(gitExitCode(root, ["merge-base", "HEAD", remoteRef], gitBaseEnv))
+    const mergeBaseExit = yield* _(gitExitCode(root, ["merge-base", "HEAD", remoteRef], env))
     if (mergeBaseExit === successExitCode) {
-      return // Histories are related — normal rebase in stateSync will handle it
+      return // Histories are related — sync will reset --soft onto the remote tip
     }
 
     // Merge unrelated histories so both are preserved; abort on conflict — stateSync will open a PR
     yield* _(Effect.logWarning(`Local history has no common ancestor with ${remoteRef}; merging unrelated histories`))
     const mergeExit = yield* _(
-      gitExitCode(root, ["merge", "--allow-unrelated-histories", "--no-edit", remoteRef], gitBaseEnv)
+      gitExitCode(root, ["merge", "--allow-unrelated-histories", "--no-edit", remoteRef], env)
     )
     if (mergeExit === successExitCode) {
       yield* _(Effect.log(`Merged unrelated histories from ${remoteRef}`))
       return
     }
     // Conflict — abort and leave resolution to stateSync (which will push a branch and log a PR URL)
-    yield* _(gitExitCode(root, ["merge", "--abort"], gitBaseEnv))
+    yield* _(gitExitCode(root, ["merge", "--abort"], env))
     yield* _(Effect.logWarning(`Merge conflict with ${remoteRef}; sync will open a PR for manual resolution`))
   })

packages/lib/src/usecases/state-repo/sync-ops.ts

@@ -52,13 +52,17 @@ const sanitizeBranchComponent = (value: string): string =>
     .replaceAll("^", "-")
     .replaceAll("~", "-")
 
-const rebaseOntoOriginIfPossible = (
+// CHANGE: stash local changes → hard reset to remote → restore local changes on top
+// WHY: remote is source of truth; local changes must overlay latest remote without losing remote updates
+// PURITY: SHELL
+// EFFECT: Effect<void, CommandFailedError | PlatformError, CommandExecutor>
+// INVARIANT: after pull, working tree == origin/{baseBranch} ∧ local modifications restored on top
+const pullRemoteAndRestoreLocal = (
   root: string,
   baseBranch: string,
   env: GitAuthEnv
-): Effect.Effect<"ok" | "skipped" | "conflict", CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
+): Effect.Effect<void, CommandFailedError | PlatformError, CommandExecutor.CommandExecutor> =>
   Effect.gen(function*(_) {
-    // Ensure we see the latest remote branch tip before attempting to rebase.
     const fetchExit = yield* _(gitExitCode(root, ["fetch", "origin", "--prune"], env))
     if (fetchExit !== successExitCode) {
       return yield* _(Effect.fail(new CommandFailedError({ command: "git fetch origin --prune", exitCode: fetchExit })))
@@ -67,17 +71,26 @@ const rebaseOntoOriginIfPossible = (
     const remoteRef = `refs/remotes/origin/${baseBranch}`
     const hasRemoteBranchExit = yield* _(gitExitCode(root, ["show-ref", "--verify", "--quiet", remoteRef], env))
     if (hasRemoteBranchExit !== successExitCode) {
-      return "skipped"
+      return // Remote branch does not exist yet (brand-new repo)
     }
 
-    const rebaseExit = yield* _(gitExitCode(root, ["rebase", `origin/${baseBranch}`], env))
-    if (rebaseExit === successExitCode) {
-      return "ok"
+    // Stash local uncommitted changes (including untracked files)
+    yield* _(git(root, ["add", "-A"], env))
+    const stashExit = yield* _(gitExitCode(root, ["stash", "--include-untracked"], env))
+
+    // Hard reset: working tree + index + HEAD = exact remote state
+    yield* _(git(root, ["reset", "--hard", `origin/${baseBranch}`], env))
+
+    // Restore local changes on top of remote
+    if (stashExit === successExitCode) {
+      const popExit = yield* _(gitExitCode(root, ["stash", "pop"], env))
+      if (popExit !== successExitCode) {
+        // Resolve conflicts by keeping local (stashed) version — local changes always win
+        yield* _(gitExitCode(root, ["checkout", "--theirs", "--", "."], env))
+        yield* _(git(root, ["add", "-A"], env))
+        yield* _(gitExitCode(root, ["stash", "drop"], env))
+      }
     }
-
-    // Best-effort: avoid leaving the repo in a rebase-in-progress state.
-    yield* _(gitExitCode(root, ["rebase", "--abort"], env))
-    return "conflict"
   })
 
 const pushToNewBranch = (
@@ -116,20 +129,14 @@ export const runStateSyncOps = (
     const originPushUrlOverride = options?.originPushUrlOverride ?? null
     const originPushTarget = resolveOriginPushTarget(originPushUrlOverride)
     yield* _(normalizeLegacyStateProjects(root))
-    yield* _(commitAllIfNeeded(root, resolveSyncMessage(message), env))
 
     const branch = yield* _(getCurrentBranch(root, env))
     const baseBranch = resolveBaseBranch(branch)
 
-    const rebaseResult = yield* _(rebaseOntoOriginIfPossible(root, baseBranch, env))
-    if (rebaseResult === "conflict") {
-      const prBranch = yield* _(pushToNewBranch(root, baseBranch, originPushTarget, env))
-      const compareUrl = tryBuildGithubCompareUrl(originUrl, baseBranch, prBranch)
-
-      yield* _(Effect.logWarning(`State sync needs manual merge: pushed changes to branch '${prBranch}'.`))
-      yield* _(logOpenPr(originUrl, baseBranch, prBranch, compareUrl))
-      return
-    }
+    // First: pull latest remote state, stashing and restoring local changes
+    yield* _(pullRemoteAndRestoreLocal(root, baseBranch, env))
+    // Then: commit local changes on top of remote
+    yield* _(commitAllIfNeeded(root, resolveSyncMessage(message), env))
 
     const pushExit = yield* _(
       gitExitCode(root, ["push", "--no-verify", originPushTarget, `HEAD:refs/heads/${baseBranch}`], env)